UK Data Reforms Broaden Lawful Processing

The UK Data Use and Access Act 2025 is bringing broad changes to data protection law, including a new recognised legitimate interests basis, revised subject access request rules, updated international transfer tests, and safeguards for automated decisions.

Most data protection provisions took effect in February 2026, while complaints-handling and regulator-governance changes follow later. The reforms may make some processing and data-use activities easier while preserving procedural rights, safeguards, and higher protections for children and other vulnerable groups.